Concurrency Issue in Mailpit Email Testing Tool

CVE-2026-45712

What is CVE-2026-45712?

Mailpit, an email testing tool and API designed for developers, faces a concurrency issue in versions prior to 1.30.0. The vulnerability arises from the unsynchronized read of a package-level assets map while simultaneously allowing both a cleanup goroutine and a CSS-rewriting code path to write to the same map under lock. This can lead to a situation where a concurrent read coincides with a write, triggering a fatal error: 'concurrent map read and map write'. The runtime error results in the entire Mailpit process crashing, which shuts down its SMTP, POP3, and HTTP listeners. Users are urged to upgrade to version 1.30.0, which contains important patches to resolve this vulnerability.

References